racob throws EXCEPTION_ACCESS_VIOLATION and crashes JRuby

[jsvd]

When using win32ole inside of logstash-input-eventlog the following made jruby crash:

# A fatal error has been detected by the Java Runtime Environment:
#
#  EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x000007fef4ec1aa4, pid=4160, tid=4756
#
# JRE version: Java(TM) SE Runtime Environment (8.0_31-b13) (build 1.8.0_31-b13)

# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.31-b07 mixed mode windows-amd64 compressed oops)
# Problematic frame:
# C  [racob-x64.dll+0x1aa4]
#
# Failed to write core dump. Minidumps are not enabled by default on client versions of Windows
#
# An error report file with more information is saved as:
# C:\logstash-1.5.0\hs_err_pid4160.log
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#

contents of the file in this gist

@enebo any idea on what this might be?

[enebo]

@jsvd not offhand no. It is entering racob trying to call something and no doubt doing it wrong. It could be an unanticipated VT_* type or I just made some bad native code. Is this plugin hard to set up?

[jsvd]

@enebo

1. on windows
2. download logstash-1.5.0
3. replace file "vendor/bundle/jruby/1.9/gems/logstash-input-eventlog-0.1.5-java/lib/logstash/inputs/eventlog.rb" with this one
4. create a "logstash.conf" file with:
   input { eventlog { logfile => [ 'Application', 'System' ] } } output { stdout { codec => dots } }
5. run logstash with bin\logstash -f logstash.conf
6. generate eventlog spam with a bat script such as

@echo off

:loop
eventcreate /ID 1 /L APPLICATION /T INFORMATION  /SO MYEVENTSOURCE /D "My first log"
goto loop

or powershell loop:

while($true)
{
write-eventlog -logname Application -source MyApp -eventID 3001 -entrytype Information -message "MyApp added a user-requested feature to the display."
sleep -m 50
}

[pkr1234]

Hi,

I'm getting this on 2.0.0 logstash on windows. Can you let us know a workaround?

[jsvd]

@pkr1234 the newer version of the logstash plugin uses a different library.
so can you please update the logstash-input-eventlog plugin using bin/plugin update logstash-input-eventlog ?

[pkr1234]

@jsvd I've just updated it. Will wait and see if the issue is resolved.

Note: It did complain about the plugin may or may not be compatible but I did it anyway 2.0.3 -> 3.0.2 if I remember correctly.

[jsvd]

since the underlying library changed we bumped the major version.We did some effort to keep it bwc..so..hopefuly it is :)

[pkr1234]

@jsvd Just wanted to drop a note to mention that upgrading the version using bin/plugin update logstash-input-eventlog worked. I have not had it crash ever since.

Thanks.

[jsvd]

@pkr1234 thank you for testing it :) happy holidays!